build(net): rustls native OS trust roots

R-P2-2: the reqwest feature was the bare "rustls-tls", which bundles the
webpki-roots Mozilla set, NOT the OS/enterprise trust store - so corporate
private CAs (TLS-inspecting proxies) failed despite the comment claiming
rustls-native-certs and DESIGN s5.8.7 wanting the OS trust store. Switched to
"rustls-tls-native-roots" so rustls-native-certs is actually pulled
(Cargo.lock now contains rustls-native-certs 0.8.4 + openssl-probe + schannel);
updated the comment to match. cargo deny check stays green (advisories / bans /
licenses / sources all ok with the new transitive deps).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CyiRqk2DVwmJjEu5gcD1m

Author: pmaxhogan

Cargo.lock

@@ -45,13 +45,16 @@ rayon = "1.10"
 # I/O-free and holds only the trait surface.
 notify = "8"
 # M3 network-resilience layer (DESIGN s5.8): the HTTP client for the
-# three-probe topology + Drive traffic. rustls so we use the OS trust store
-# via rustls-native-certs (DESIGN s5.8.7). The DNS re-resolution probe
-# (DESIGN s5.8.1) uses `tokio::net::lookup_host`, not a resolver crate;
-# `hickory-resolver` was the optional s5.8.5 escalation and is not wired in V1
-# (dropped to clear RUSTSEC-2026-0119 in hickory-proto's name compression).
+# three-probe topology + Drive traffic. `rustls-tls-native-roots` (NOT the bare
+# `rustls-tls`, which bundles the webpki-roots Mozilla set) pulls
+# `rustls-native-certs` so we trust the OS / enterprise trust store - corporate
+# private CAs work behind a TLS-inspecting proxy (DESIGN s5.8.7, codex R-P2-2).
+# The DNS re-resolution probe (DESIGN s5.8.1) uses `tokio::net::lookup_host`,
+# not a resolver crate; `hickory-resolver` was the optional s5.8.5 escalation
+# and is not wired in V1 (dropped to clear RUSTSEC-2026-0119 in hickory-proto's
+# name compression).
 reqwest = { version = "0.12", default-features = false, features = [
-    "rustls-tls",
+    "rustls-tls-native-roots",
     "http2",
     "stream",
 ] }